Suspicious Chromium Browser Instance Executed With Custom Extension

Title: Suspicious Chromium Browser Instance Executed With Custom Extension
Status: test
Description:Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension
References:
  -https://redcanary.com/blog/chromeloader/
  -https://emkc.org/s/RJjuLa
  -https://www.mandiant.com/resources/blog/lnk-between-browsers
Author: Aedan Russell, frack113, X__Junior (Nextron Systems)
Date: 2022-06-19
modified:2023-11-28
Tags:

• -'attack.persistence'
• -'attack.t1176.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith:
      -'\cmd.exe'
      -'\cscript.exe'
      -'\mshta.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\regsvr32.exe'
      -'\rundll32.exe'
      -'\wscript.exe'

    Image|endswith:
      -'\brave.exe'
      -'\chrome.exe'
      -'\msedge.exe'
      -'\opera.exe'
      -'\vivaldi.exe'

    CommandLine|contains: '--load-extension='
  condition:selection
Falsepositives:
  -Unknown
Level: high